Malicious PDF — malware analysis report

Static analysis result for SHA-256 95e4b0038acb1e5d…

MALICIOUS

PDF

44.5 KB Created: 2020-03-30 13:43:42 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 4565ac696eb1a01e4c1507687c780b35 SHA-1: 42cee4ef8b7b4826f8e0d5274a265e62301e3676 SHA-256: 95e4b0038acb1e5da96cc905befb12c611da87b449464852e823c7775b2a56f0
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The document body, though partially corrupted, contains text related to mathematical formulas and references to the wkhtmltopdf tool. The primary attack vector appears to be directing users to a network of linked websites, likely for malicious purposes such as malware distribution or phishing. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://74-123-77-90.mgwnet.com/uploads/1/3/0/5/130589348/130589348.html#formulas+volumen+prisma+cilindro
    • http://mx.tricountypullersinc.com/uploads/1/3/0/6/130620296/9645127.pdf
    • http://waterheatersandspares.com/uploads/1/3/0/8/130813478/lonati.pdf
    • http://rhode-island-psychotherapy.com/uploads/1/3/0/5/130539792/3a19d9b6.pdf
    • http://waterbaptised2017.com/uploads/1/3/0/6/130639768/3178278.pdf
    • http://portfoliobar.com/uploads/1/3/0/6/130640013/jugiri_jabezatakapebub.pdf
    • http://www.thewoodbeecabin.com/uploads/1/3/0/5/130539758/veravurotukuda.pdf
    • http://www.alltechif.com/uploads/1/3/1/4/131410126/3333059.pdf
    • http://ashonfood.com/uploads/1/3/0/2/130271217/tudewajone_disuselerulafew_womerumubikem.pdf
    • http://charissaanggita.com/uploads/1/3/0/2/130271019/legubawubakujez_tazedir_lisero_lugotuj.pdf
    • http://highmoda.eu/uploads/1/3/0/3/130313436/1186444.pdf
    • http://emmaperkinseportfolio.com/uploads/1/3/0/6/130604759/6652243.pdf
    • http://cityfamilyclinic.com/uploads/1/3/0/5/130551095/sefojax-xiwalopisor-pujatajozuzarek-soliwaminujires.pdf
    • http://snorestopwatch.com/uploads/1/3/0/7/130776891/kexewiluv.pdf
    • http://mindfulnesslab.centre4innovation.org/uploads/1/3/1/4/131453858/687060.pdf
    • http://mycoloradoorthodontist.com/uploads/1/3/0/2/130288338/walevuxogigov-dufadusazuduf.pdf
    • http://rlconstructionwa.com/uploads/1/3/0/3/130323209/e899dba.pdf
    • http://amayajames.com/uploads/1/3/0/5/130588956/53fce048ee7.pdf
    • http://riveralexander.com/uploads/1/3/0/8/130874143/mosonalikoxev_bavonorodidixe_dakamerukir_luzujowij.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007727.bin
9b19c888c7938ace7c13019ab345dd00c1863135d74311e18eb9181fe6356b03		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7727 10612 bytes
font_01_sfnt_off00009a2e.bin
83459e82cebe561b9e65dda6a09953c9e35f75e5df0fa62a624e1833cc5b8086		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9A2E 1708 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.